Vulnerabilities / Threats
7/8/2009
02:37 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Link Shrinkage Powers Spam Surge

The popularity of Twitter has lead to a proliferation of URL shortening services. Now spammers are taking notice and using link reduction to hide spam links.

Concerns raised in April about the security implications of Web link shortening services have proven to be well-founded: The presence of shortened URLs in spam messages has surged in the past week.

Shortened URLs now appear in more than 2% of spam messages, according to MessageLabs. Matt Sergeant, senior anti-spam technologist at the security company, attributes the spike to the development of automated tools for submitting Web links to URL shortening services.

"These services definitely do have a problem with spam links," he said. "What we haven't seen before is the large scale use of URL shortening services in e-mail spam."

Rising usage of sites like Facebook and Twitter, which offer limited-length messaging, has led more people to use services like TinyURL and bit.ly to shrink sprawling online links to a short string of characters. And with usage, investors have followed, allowing bit.ly to raise $2 million in March.

The possibility that these services may someday generate real revenue by serving as middle men between online publishers and Internet users has undeniable business appeal. But the middle man model can be subverted so that it's essentially a man-in-the-middle attack.

A man-in-the-middle attack typically refers to a communications scenario where an attacker relays messages between two parties without their knowledge. Though URL shortening services don't operate covertly, the users of such services may conceal their intent and those clicking on links disguised by such services often don't consider the implications.

"It really breaks down the whole trust model of the URL," said Sergeant. "When you look at a URL you can see, for example, that it points to the New York Times Web site. With these you have no idea where you end up."

Del.icio.us founder Joshua Schachter, now a Google employee, published a blog post in April summarizing several problems surrounding URL shortening services. Beyond issues of poor usability, search rank damage for publishers, and diminished navigability over time, he confirmed that URL shortening services are popular with spammers.

"[A] link that used to be transparent is now opaque and requires a lookup operation," he said. "From my past experience with Del.icio.us, I know that a huge proportion of shortened links are just a disguise for spam, so examining the expanded URL is a necessary step."

Sergeant blames Twitter in part because the service insists on a 140 character limit to accommodate mobile phone messaging conventions. "I personally think the 140 character restriction is a bit ridiculous," he said. "Twitter is partly responsible for this problem. You just can't fit URLs in that space."

Twitter could fetch site names from URLs submitted by users and replace the display text of Twittered links with the destination domain. But doing so would require a lot of behind-the-scenes Web queries, which might require more computing power than the company wants to deploy to address the issue.

Until a technical solution emerges, short URLs are likely to remain risky.

"It's an ongoing problem and it's certainly not going to go away any time soon," said Sergeant.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.